MEMO 


To: 

Russ Larson 

From: 

D. Eyles 

C. Schulenberg 

A. Klumpp 

Date: 

July 20, 1971 

Subject: 

Backing Up Failed CDUs 


This memo presents an erasable program, and related procedures, 
developed by the authors for backing up one or more failed CDUs during 
landings, ascents, and aborts. For the benefit of anyone who came in 
late, here is a survey of the path that led to this result. At first MIT's 
efforts were directed toward the limited problem of frozen CDU counters. 

We proposed to fly noun 22 using AGS attitude-hold (since the PGNCS 
autopilot would obviously be hors de combat), and concentrated on finding 
ways to eliminate the thrust-offset error of up to 7° introduced into noun 
22 by FINDCDUW. When these techniques proved unweildy, it was 
noticed that an erasable program executed between Servicer and Guidance 
could place the XNBPIP vector in the DELV cells, and this would convince 
FINDCDUW that thrust was along the spacecraft x-axis, and thus zero the 
thrust-offset error in noun 22. This 9 word erasable program was partially 
tested at Grumman. Its difficulties were that it had to be renewed by the 
Astronaut via the DSKY following a P70 or P71 abort, and that it covered 
only frozen CDU failures. It was because this was considered an unlikely 
form of CDU failure that a broader solution was sought. 

On the next page are the procedures proposed. On the following 
pages the erasable program is described. 
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Procedures to Back Up Failed CDUs 


Before selection of P63: 

Load erasable program. (See loads on pages 9-11.) 

Before PDI: 

GUID CONT to AGS 
PGNCS MODE to OFF 
Manual ullage. 

Manual engine-on. 

Between PDI and throttle-up (or earlier, see page 5): 

V 21 N 1 E 335 E 250 E. (Activates erasable program.) 

After throttle-up: 

V 16 N 87 E. (This monitor may be requested earlier but 

N87 contains garbage until guidance starts at throttle-up. ) 

Use HI for pitch. Use R2 for roll. Yaw to zero before V57. 

Features 


All parts of the LGC program will work properly except the 
Landing Analog Displays and the Redesignator. The cross-pointers 
will give velocities in the downrange and crossrange rather than the 
body-oriented forward and lateral directions. The Redesignator should 
not be enabled — flashing N64 in P64 should not be PROCEEDed on — 
because if it is, hand controller deflections used in flying AGS attitude-hold 
will be interpreted by the PGNCS as site redesignations. 

LR updates may be enabled (subject to confirmation in tests). 

Either the N8 7 monitor will have to be key-released occasionally to 
look at DELTAH, or else the ground will have to monitor it and tell the 
Astronaut when V57 is appropriate. 

Subject to the assumptions below, the erasable program can cope 
with a failure of all three CDUs. Failures in which one or two remain 
healthy may make minor modifications desirable, as discussed on page 8. 

The erasable program is restart protected and will continue to 
work through a P70 or P71 abort. 
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Assumptions 


It is assumed that the platform is stable and correctly 
aligned for landing. It is also assumed that there is time to load 
and check the erasable program before the landing must begin. 

In other words, the failure must occur between alignment and the 
selection of P63. This unfortunately excludes failures detected at 
activation time — intuitively the most likely case — unless someone 
finds a way to align the platform despite faulty CDUs. 

The CDU failures covered by the erasable program presented 
here include both quiescent and hunting CDUs. In other words, failures 
in which the CDU freezes at some value, and failures in which the CDU 
is being incremented or decremented erroneously, no matter at what 
rate, are covered. Failures in which a bit is broken, so that the CDU 
can change its value in big jumps, make use of the LR to update the 
PGNCS state vectors unadvisable, but otherwise they are covered too, 
except for the possibility that GLOCKMON might be led to believe 
that gimbal lock has occured. 

Description 

The erasable program consists of two parts. One is executed 
every 2 seconds between Servicer and Guidance. The other is 
executed every 20 ms. as part of the downrupt. 

The 2 second routine computes the desired CDUY and CDUZ values 
from the thrust-axis commanded by guidance (UNFC/2), and puts them 
in N87 where they may be monitored using V16 and flown using the AGS 
autopilot — thus short-circuiting FINDCDUW. R1 gives CDUYD, R2 
gives CDUZD. N8 7 was chosen J>ecause it uses the right scaling routine 

and because it lies in unswitched erasable memory. N22 cannot be used 

# 

because FINDCDUW, which computes it, may still be functioning. (No 
way is available to turn off FINDCDUW 100% of the time.) The 2 second 
routine also computes the actual gimbal angles which would show up in 
CDUY and CDUZ if they were not sick, from the DELV vector — under the 
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assumption that there is little thrust offset. The desired and "actual" 
CDUs are extracted from the UNFC/2 and DELV vectors, respectively, 
using the following expression of the spacecraft x-axis in stable member 
coordinates: 

XNB = (cosCDUY cosCDUZ, sinCDUZ, - sinCDUY T cosCDUZ). 

Thus the arcsin of the middle component of DELV (or UNFC/2), unitized, 
is CDUZ (or CDUZD). Then, after the middle component is zeroed and 
the vector unitized again, the first and third components, respectively 
the cosine and negative sine of CDUY (or CDUYD), are used to find 
that angle. The 2 second routine is put in the Servicer loop by the 
20 ms. routine, as told below. 

Like the DSKY backup program, the second part of the CDU 
backup program is executed every 20 ms. as part of the downrupt. 

It zeroes CDUX and plugs the values computed by the 2 second routine 
into the CDUY and CDUZ registers. Since this setting occurs every 
20 ms. no CDU can read a value more than 6400 x .020 = 1.6° from 
the value computed from DELV. This adds new meaning to the problem 
of lost downrupts, but these computed "actual" CDU angles should 
nevertheless remain accurate enough to permit LR updates, and to 
prevent GLOCKMON from sensing gimbal lock if CDUZ is runaway. 

The 20 ms. routine also insures that AVGEXIT contains the address of 
the 2 second routine (661), and that the return from the 2 second 
routine is to the appropriate guidance program. This makes it 
necessary for the Astronaut to start up the 20 ms. routine only — 
it in turn starts up the 2 second routine — and also lets the erasable 
program survive the P70-P71 lead-in, where a new value is put into 
AVGEXIT. The 20 ms. routine restart protects itself, and every pass 
it increments REDOCTR by 100 to show the ground, via downlink, that 
it is functioning. The only gap in the 20 ms. routine 1 s restart 
protection is during antenna repositioning at high-gate, when a hardware 
restart would kill it. However, the 2 second routine, which as part of 
the Servicer job is fully restart protected, insures that the 2o ms. 
routine is on the air. Thus trie only real vulnerability is in the event 
that P70 or P71 is selected at the same moment as a hardware restart 
at high-gate. This seems avoidable. 
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Starting the Erasable Program Earlier 


On page 2 the keystrokes to activate the erasable program are 
specified for between PDI and throttle-up. Normally, this is the last 
possible moment before it is needed. If, let us say, CDUZ were 
runaway, it might be needed earlier to keep GLOCKMON from sensing 
apparent gimbal lock (CDUZ greater than 85°) and throwing the IMU 
into coarse align — which is definitely undesirable. The only problem 
with starting it earlier is that between TIG-30 and ullage the 2 second 
routine would compute '’actual" CDUs from a DELV that contains only 
uncompensated PIPA bias, and could point in any direction. So the 
computed CDUs could be crazy. Fortunately, since the single-precision 
arcsin routine used never outputs an angle greater than 81.4°, even if 
the DELV vector’s magnitude were all along the stable member y-axis, 
CDUZ would never be computed as in gimbal lock. Also, even at 
maximum rate of 6400 pps, it could never reach 85° before the 20 ms. 
routine comes around to set it again. Putting crazy values into the 
CDU counters has no other pernicious effect. 

Memory Utilization 

The erasable program here described uses all of three core sets 
and most of vac area 5. Normally a landing never needs these areas. 
The only cells unused in vac 5 are two of the four cells overwritten on 
restarts (the other two are used as temporaries) and the last two. The 
erasable program is given on the next two pages. 
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address 

octal 

meaning 


0250 

00300 

TC 

0300 

0251 

54032 

TS 

CDUX 

0252 

10752 

CCS 

PHASE1 

0253 

00261 

TC 

0261 

0254 

05355 

TC 

PHASCHNG 

0255 

07011 

OCT 

07011 

0256 

77777 

OCT 

77777 

0257 

00311 

OCT 

00311 

0260 

10100 

OCT 

10100 

0261 

34770 ' 

CA 

1SEC 

0262 

26320 

ADS 

REDOCTR 

0263 

77776 

MASK 

7776 

0264 

41251 

CS 

AVGEXIT 

0265 

60267 

AD 

0267 

0266 

10000 

CCS 

A 

0267 

00661 

OCT 

00661 

0270 

00250 

OCT 

00250 

0271 

00273 

TC 

0273 

10272 

00676 

TC 

0676 

0273 

31251 

CA 

AVGEXIT 

0274 

54674 

TS 

0674 

0275 

30267 

CA 

0267 

0276 

00675 

TC 

0675 

0277 

77776 



0300 

30270 

CA 

0270 

0301 

54335 

TS 

DNTMGOTO 

0302 

44744 

CS 

BIT1 

0303 

54263 

TS 

0263 

0304 

54277 

TS 

0277 

0305 

54313 

TS 

0313 

0306 

34746 

CA 

ZERO 

0307 

54660 

TS 

VAC5USE 

0310 

00002 

TC 

Q 

0311 

00300 

TC 

0300 

0312 

05263 

TC 

TASKOVER 

0313 

77776 




subro at 0300 returns with zero in A 


to tell the ground that we are on the air 
non-functional: reserves core set 

positive impossible 
positive zero impossible 


not executed: reserves core set 


reserves core set 6 
reserves core set 7 
reserves core set 8 

reserves vac area 5 


not executed: reserves core set 
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address 

0660 
0661 
0662 
0663 
0664 
0665 
0666 
0667 
0670 
0671 
0672 
0673 
0674 
0675 
0676 
0677 
0700 
0701 
0702 "P 
0703 i 
0704 
0705 
0706 7 
0707 5 
0710 
0711 
0712 
0713 
0714 
0715 
0716 
0717 
0720 
0721 
0722 
0723 
0724 
0725 
0726 
0727 
0730 
0731 


CHARLES 


octal meaning 


00000 

00300 

TC 

0300 

06060 

TC 

INTPRET 

77575 

VLOAD 

EXIT 

03252 


UNFC/2 

00710 

TC 

0710 

53345 

DXCI4 

AZ 

06060 

TC 

INTPRET 

77575 

VLOAD 

EXIT 

00325 


DELV 

00710 

TC 

0710 

52703 

DXCH 

0702 


TC 

guidance 

55251 

TS 

AVGEXIT 

00006 

EXTEND 

30703 

DCA 

0702 

52034 

DXCH 

CDUY 

03532 

TC 

DNPHASE2 


not executed: reserves vac area 5 
compute CDUDs from UNFC/2 

compute CDUs from DELV 

inserted by 20 ms. routine 


used for storage of values for CDUY and CDUZ 

overwritten on restart: used for return address by subro at 0710 
overwritten on restart: used for temporary storage by subro at 0710 


not used 

00006 

22704 
06060 
77456 
30157 
04607 TC 

61656 CADR 

54705 TS 

06060 TC 

53434 RTB 

63671 

77776 EXIT 

22154 LXCH 

40161 CS 

04607 TC 

61606 CADR 

22705 LXCH 

00704 TC 


EXIT 

MPAC +3 
BANKCALL 
SPARCSIN -1 
0705 

INTPRET 

UNIT 

ZEROMID 

MPAC 
MPAC +5 
BANKCALL 
ARCTRGSP 
0705' 

0704 


EXTEND 
QXCH 0704 
TC INTPRET 

UNIT 
CA 
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Possible Modifications 


In the event that one or more CDUs remain normal, it may¬ 
be desirable to make minor modifications to the erasable program 
to permit making use of the data they provide. If CDUX is okay, 
the word at 0251 should be changed to 30000 (CA A) to prevent it 
from being overwritten. Similarly, if CDUY is healthy the word 
at 0700 should be 22034 (LXCH CDUZ), and if CDUZ is healthy 
0700 should be 54033 (TS CDUY). The only reason to make more 
drastic changes to the erasable program in the event of one or two good 
CDUs would be to save a little computation time. Note that if 
CDUY and CDUZ were both okay word 0700 could be changed to 30000 
(CA A), but in this case it would be better to do without the 
erasable program entirely, since the FINDCDUW computed values in N22 
are accurate. 

The PGNCS digital autopilot is turned off to releive the LGC 
of 20% computation time. This time would be needed if all three 
CDUs were failed in their runaway mode — in which they would 
create 3 x 6400 x 11. 72 microseconds = 22. 5% time-loss. To gain 
still more time FINDCDUW could be prevented from operating most 
of the time if the necessary words could be found to set a component of 
UNWC/2, the window-command vector, to POSMAX. This would 
cause the UNIT operation on UNWC/2 in FINDCDUW to overflow, and 
at that FINDCDUW would give up. This seems superfluous however, 
since even with the estimated 5% consumed by the erasable program 
and three runaway CDUs there would be' at least 5% margin in all phases 



CHARLES STARK DRAPER LABORATORY DIV. OF MASSACHUSETTS INSTITUTE OF TECHNOLOGY CAMBRIDGE. MASS. 


Loading the Erasable Program 


Five separate loads are necessary. The LGC must be 
in POO. The erasable location for which a particular entry is 
destined is given to the right. 


Load 1: V 71 

24 
250 
300 
'54032 
10752 
261 
5355 
7011 
77777 
311 
10100 
34770 
26320 
77776 
41251 
60267 
10000 
661 
250 
273 

V 33 

Load 2: V 71 

24 
272 
676 
31251 
54674 
30267 
675 
77776 
30270 
54335 
44744 
54263 
54277 
54313 
34746 
54660 
2 

300 

5263 

77776 

V 33 


E 


E 


E 


E 

250 

E 

251 

E 

252 

E 

253 

E 

254 

E 

255 

E 

256 

E 

257 

E 

260 

E 

261 

E 

262 

E 

263 

E 

264 

E 

265 

E 

266 

E 

267 

E 

270 

E 

271 

E 


E 


E 


E 


E 

272 

E 

273 

E 

274 

E 

275 

E 

276 

E 

277 

E 

300 

E 

301 

E 

302 

E 

303 

E 

304 

E 

305 

E 

306 

E 

307 

E 

310 

E 

311 

E 

312 

E 

313 

E 
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Load 3: 


V 71 

E 


24 

E 


660 

E 



E 

660 

300 

E 

661 

6060 

E 

662 

77575 

E 

663 

3252 

E 

664 

710 

E 

665 

53345 

E 

666 

6060 

E 

667 

77575 

E 

670 

325 

E 

671 

710 

E 

672 

52703 

E 

673 


E 

674 

55251 

E 

675 

6 

E 

676 

30703 

E 

677 

52034 

E 

700 

3532 

E 

701 

V 33 

E 


V 71 

E 


24 

E 


710 

E 


6 

E 

710 

22704 

E 

711 

6060 

E 

712 

77456 

E 

713 

30157 

E 

714 

4607 

E 

715 

61656 

E 

716 

54705 

E 

717 

6060 

E 

720 

53434 

E 

721 

63671 

E 

722 

77776 

E 

723 

22154 

E 

724 

40161 

E 

725 

4607 

E 

726 

61606 

E 

727 

22705 

E 

730 

704 

E 

731 

V 33 

E 
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Load 5: 


V 72 

E 


7 

E 


1251 

E 


3656 

E 

1251 

702 

E 



E 

702 

703 

E 



E 

703 

V 33 

E 



Note that Load 5 includes data necessary if the erasable program 
is to be started up prior to TIG-30. 
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